openclaw/CHANGELOG/2026.4.21.md

2026.4.21

Changes

• OpenAI/images: default the bundled image-generation provider and live media smoke tests to gpt-image-2, and advertise the newer 2K/4K OpenAI size hints in image-generation docs and tool metadata.
• Plugins/skills: add the Skill Workshop plugin, which captures reusable workflow corrections as pending or auto-applied workspace skills, runs threshold-based reviewer passes for stronger completion bias on reusable procedures, quarantines unsafe proposals, and refreshes skill availability after safe writes.
• Plugin SDK/channels: add presentation and skills runtime contracts, decouple channel presentation rendering, and document message presentation cards so plugins can own richer interactive surfaces without channel-specific glue.
• Fireworks/models: add Kimi K2.6 (fireworks/accounts/fireworks/models/kimi-k2p6) to the bundled catalog and live-model priority list, while keeping Kimi thinking disabled for Fireworks K2.6 requests.
• Onboard/wizard: simplify the security disclaimer copy, and switch remaining onboarding pickers with long dynamic option lists to searchable autocompletes for search providers, plugin configuration, and model provider filtering (#69760). Thanks @Patrick-Erichsen.
• Channels/preview streaming: stream tool-progress updates into live preview edits for Discord, Slack, and Telegram so in-flight replies show incremental tool state in the same preview message before finalization. (#69611) Thanks @thewilloftheshadow.
• Ollama/onboard: populate the cloud-only model list from ollama.com/api/tags, cap the discovered list at 500, and fall back to static suggestions when ollama.com is unavailable. (#68463) Thanks @BruceMacD.
• QQBot: extract a self-contained engine architecture with QR-code onboarding, native approval handling via /bot-approve, per-account resource stacks, credential backup/restore, shared media storage, and unified API/bridge/gateway modules. (#67960) Thanks @cxyhhhhh.
• Matrix/startup: narrow Matrix runtime registration and defer setup/doctor surfaces so cold plugin registration spends about 1.8s less in setChannelRuntime. (#69782) Thanks @gumadeiras.
• Telegram/plugin startup: load Telegram's bundled runtime setter through a narrow sidecar and native built-sidecar loading, cutting measured setup-runtime registration by about 14s while preserving runtime API compatibility. (#69786) Thanks @gumadeiras.
• Discord/plugin startup: lazy-load the Carbon UI runtime and load Discord's bundled runtime setter through a narrow sidecar, cutting measured registration time by about 98% while keeping packaged installs off Carbon until the Discord UI surface is needed. (#69791) Thanks @gumadeiras.

Fixes

• Agents/ACP: skip the sessions_send A2A ping-pong flow when a parent sends to its own background oneshot ACP child, preventing parent/child echo loops while preserving normal A2A delivery for non-parent senders. (#69817) Thanks @scotthuang.
• Image generation: log failed provider/model candidates at warn level before automatic provider fallback, so OpenAI image failures are visible in the gateway log even when a later provider succeeds.
• Agents/subagents: stop terminal failed subagent runs from freezing or announcing captured reply text, so failover-exhausted runs report a clean failure instead of replaying stale assistant/tool output.
• Security/external content: strip common self-hosted LLM chat-template special-token literals, including Qwen/ChatML, Llama, Gemma, Mistral, Phi, and GPT-OSS markers, from wrapped external content and metadata, preventing tokenizer-layer role-boundary spoofing against OpenAI-compatible backends that preserve special tokens in user text.
• npm/install: mirror the node-domexception alias into root package.json overrides, so npm installs stop surfacing the deprecated google-auth-library -> gaxios -> node-fetch -> fetch-blob -> node-domexception chain pulled through Pi/Google runtime deps. Thanks @vincentkoc.
• Auth/commands: require owner identity (an owner-candidate match or internal operator.admin) for owner-enforced commands instead of treating wildcard channel allowFrom or empty owner-candidate lists as sufficient, so non-owner senders can no longer reach owner-only commands through a permissive fallback when enforceOwnerForCommands=true and commands.ownerAllowFrom is unset. (#69774) Thanks @drobison00.
• Control UI/CSP: tighten img-src to 'self' data: only, and make Control UI avatar helpers drop remote http(s) and protocol-relative URLs so the UI falls back to the built-in logo/badge instead of issuing arbitrary remote image fetches. Same-origin avatar routes (relative paths) and data:image/... avatars still render. (#69773) Thanks @drobison00.
• CLI/channels: keep status, health, channels list, and channels status on read-only channel metadata when Telegram, Slack, Discord, or third-party channel plugins are configured, avoiding full bundled plugin runtime imports on those cold paths. Fixes #69042. (#69479) Thanks @gumadeiras.
• Synology Chat: validate outbound webhook file_url values against the shared SSRF policy before forwarding to the NAS, rejecting malformed URLs, non-http(s) schemes, and private/blocked network targets so the NAS cannot be used as a confused deputy to fetch internal addresses. (#69784) Thanks @eleqtrizit.
• LINE: validate outbound media URLs against the shared public-network guard before handing them to LINE, preserving arbitrary public HTTPS media while rejecting loopback, link-local, and private-network targets.
• Gateway/Control UI: require gateway auth on the Control UI avatar route (GET /avatar/<agentId> and ?meta=1 metadata) when auth is configured, matching the sibling assistant-media route, and propagate the existing gateway token through the UI avatar fetch (bearer header + authenticated blob URL) so authenticated dashboards still load local avatars. (#69775) Thanks @drobison00.
• Google Chat/auth: replace the Google auth gaxios shim with a scoped SSRF-guarded transport, validate service-account auth endpoints against trusted Google URLs, and let the plugin own its staged gaxios auth runtime instead of patching process-wide globals or the root CLI startup path. Thanks @vincentkoc.
• Exec/allowlist: reject POSIX parameter expansion forms such as $VAR, $?, $$, $1, and $@ inside unquoted heredocs during shell approval analysis, so these heredocs no longer pass allowlist review as plain text. (#69795) Thanks @drobison00.
• Gateway/MCP loopback: derive owner-only tool visibility from distinct authenticated owner vs non-owner loopback bearers instead of the caller-controlled owner header, so non-owner MCP child processes cannot recover owner access by spoofing request metadata. (#69796) Thanks @drobison00.
• GitHub Copilot: update the default Opus model from claude-opus-4.6 to claude-opus-4.7 after GitHub removed Copilot support for 4.6. (#69818) Thanks @shakkernerd.
• OpenShell: pin host-side sandbox writes under the mounted root so symlink-parent rebinds cannot redirect writeFile outside the workspace during local mirror updates. (#69797) Thanks @drobison00.
• Ollama/media understanding: register Ollama as an image-capable media-understanding provider so agents.defaults.imageModel.primary values like ollama/qwen2.5vl:7b route through the Ollama plugin instead of failing as unknown models. (#69816) Thanks @soloclz.
• CLI/media understanding: make openclaw infer image describe --model <provider/model> execute the explicit image model instead of skipping description when that model supports native vision (#69816).
• Usage/providers: keep plugin-owned usage auth enabled when manifest-declared provider auth env vars such as MINIMAX_CODE_PLAN_KEY are present, so /usage can resolve MiniMax billing credentials through the provider plugin.
• Tlon/uploads: route both hosted Memex upload targets and custom-S3 presigned upload URLs through the shared SSRF guard so blocked private or loopback destinations fail before upload, while public upload URLs continue through the existing hosted upload flow. (#69794) Thanks @drobison00.
• Channels/thread routing: keep outbound replies in existing Slack, Mattermost, Matrix, Telegram, Discord, and QA-channel thread sessions by sharing the Plugin SDK thread-aware route builder across bundled plugins.
• Agents/replay: normalize restored assistant text content before provider replay and prompt submission, so legacy or repaired sessions no longer crash on assistantMsg.content.flatMap. (#69850) Thanks @fuller-stack-dev.